1007926d5ec79b147ef2fc0a08b5cc651d6da1937b60746aa8e526748370d4d1

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe
Size 23.5MB
Sample260728-fgfcrsfa83
SHA256 1007926d5ec79b147ef2fc0a08b5cc651d6da1937b60746aa8e526748370d4d1
MD5 416d47766f0e1228c816e06b7157bc1d
SHA1 b886b44e43f06516a9de0e774cb3b55b2525f29b
SHA512 eda9497cc5e1b3971610b3c3b0ec6d5824d06f26357a8e19eea7cde0fa215a97032b7c57b5bd7172465daef8933ec2d62d8dedf1f40e69e84f394260ff9c0995
SSDEEP 393216:hhPAmFvwaRZ6dpQeVDedjh2noNiD0wmgGFULI9E4brV/AH:QmKeth2noNk4bB0
TLSH
T1464739217A5B996CD09BC47483478A760A7130DB0B39B9FF44D492382F6EBF56F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	5580	2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe

Executes dropped EXE 2 IoCs

pid	Process
992	DXSetup.exe
2740	dxwsetup.exe

Loads dropped DLL 2 IoCs

pid	Process
2740	dxwsetup.exe
2740	dxwsetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	DXSetup.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET40F7.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SET40F7.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET40F8.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SET40F8.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup32.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup	dxwsetup.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_252892348\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_252892348\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_252892348\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_252892348\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_252892348\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_691454079\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_691454079\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_252892348\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_999453957\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_999453957\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_999453957\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_691454079\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_252892348\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_252892348\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_252892348\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_252892348\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_999453957\metadata.pb	msedgewebview2.exe
File opened for modification	C:\Windows\Logs\DirectX.log	dxwsetup.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	dxwsetup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3104_252892348\passwords.txt	msedgewebview2.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwsetup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1056	msedgewebview2.exe
1056	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3104	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5580	2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5580 wrote to memory of 3104	5580	2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe	89
PID 3104 wrote to memory of 3492	3104	msedgewebview2.exe	90
PID 3104 wrote to memory of 4324	3104	msedgewebview2.exe	91
PID 3104 wrote to memory of 4324	3104	msedgewebview2.exe	91
PID 3104 wrote to memory of 4324	3104	msedgewebview2.exe	91
PID 3104 wrote to memory of 4324	3104	msedgewebview2.exe	91
PID 3104 wrote to memory of 1240	3104	msedgewebview2.exe	92
PID 3104 wrote to memory of 3716	3104	msedgewebview2.exe	93
PID 3104 wrote to memory of 3716	3104	msedgewebview2.exe	93
PID 3104 wrote to memory of 3716	3104	msedgewebview2.exe	93
PID 3104 wrote to memory of 240	3104	msedgewebview2.exe	94
PID 3104 wrote to memory of 240	3104	msedgewebview2.exe	94
PID 3104 wrote to memory of 240	3104	msedgewebview2.exe	94
PID 3104 wrote to memory of 240	3104	msedgewebview2.exe	94
PID 3104 wrote to memory of 240	3104	msedgewebview2.exe	94
PID 5580 wrote to memory of 992	5580	2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe	95
PID 992 wrote to memory of 2740	992	DXSetup.exe	96
PID 3104 wrote to memory of 1308	3104	msedgewebview2.exe	101
PID 3104 wrote to memory of 1308	3104	msedgewebview2.exe	101
PID 3104 wrote to memory of 1308	3104	msedgewebview2.exe	101
PID 3104 wrote to memory of 936	3104	msedgewebview2.exe	102
PID 3104 wrote to memory of 936	3104	msedgewebview2.exe	102
PID 3104 wrote to memory of 936	3104	msedgewebview2.exe	102
PID 3104 wrote to memory of 1056	3104	msedgewebview2.exe	103
PID 3104 wrote to memory of 4148	3104	msedgewebview2.exe	104
PID 3104 wrote to memory of 4148	3104	msedgewebview2.exe	104
PID 3104 wrote to memory of 4148	3104	msedgewebview2.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5580
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.0.6 --user-data-dir="C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5580.3096.13419941439142112357 /pfhostedapp:f98782bb72dde5da5150fe5391216cd2ccfcd2f9
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView /prefetch:4 /pfhostedapp:f98782bb72dde5da5150fe5391216cd2ccfcd2f9 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb21c75fd8,0x7ffb21c75fe4,0x7ffb21c75ff0
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView" --webview-exe-name=2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,7424136502153558548,16229710184822165248,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f98782bb72dde5da5150fe5391216cd2ccfcd2f9
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView" --webview-exe-name=2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2196 --field-trial-handle=1772,i,7424136502153558548,16229710184822165248,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f98782bb72dde5da5150fe5391216cd2ccfcd2f9
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView" --webview-exe-name=2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1772,i,7424136502153558548,16229710184822165248,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f98782bb72dde5da5150fe5391216cd2ccfcd2f9
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView" --webview-exe-name=2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3444 --field-trial-handle=1772,i,7424136502153558548,16229710184822165248,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f98782bb72dde5da5150fe5391216cd2ccfcd2f9 /prefetch:1
    3⤵
    PID:240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView" --webview-exe-name=2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=1772,i,7424136502153558548,16229710184822165248,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f98782bb72dde5da5150fe5391216cd2ccfcd2f9
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView" --webview-exe-name=2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=820 --field-trial-handle=1772,i,7424136502153558548,16229710184822165248,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f98782bb72dde5da5150fe5391216cd2ccfcd2f9
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView" --webview-exe-name=2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4456 --field-trial-handle=1772,i,7424136502153558548,16229710184822165248,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f98782bb72dde5da5150fe5391216cd2ccfcd2f9
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView" --webview-exe-name=2026-07-28_416d47766f0e1228c816e06b7157bc1d_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=1772,i,7424136502153558548,16229710184822165248,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f98782bb72dde5da5150fe5391216cd2ccfcd2f9
    3⤵
    PID:4148
- C:\Users\Admin\AppData\Local\Temp\DXSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\DXSetup.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.download_state.json

Path C:\Users\Admin\AppData\Local\Temp\.download_state.json
Size 13KB
SHA256 0c104d61419aa63759ab6aaad6f59a009fd502b5d305485b3455f42ce68a0305
MD5 83080d76fb6aa65bf8ce2e4b4198a3c7
SHA1 12e93311e7906bc8faa51c564981c114eebfc34d
SHA512 c49ebfc9883177e97283b387880e7a8bb3063b0b37a9fa1356db3c948fe1b9b9a217b3f1b271edf405e259632591f5353d0c1e60137d611eb419626daf7c6217
SSDEEP 96:BewwJHjtgHR9g/lCCK5sp0NXmgo2vioGF+naXZqWnEN6UiUVQy7En/sr4Pb8u1bd:BedHjM98PPQ3JaAW2oPoruk15Akc
TLSH
T1D352DF33C1319CA63988A97E893E9153238011770E693D0D7F5E854CAF6F63D36B2AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\DXSetup.exe
Size 288KB
SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
MD5 2cbd6ad183914a0c554f0739069e77d7
SHA1 7bf35f2afca666078db35ca95130beb2e3782212
SHA512 ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
SSDEEP 6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
TLSH
T19654F15197E4817BE4FA1B311DF2025327797DE86CB9E32E838658881D71780BE35B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
Size 93KB
SHA256 57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308
MD5 984cad22fa542a08c5d22941b888d8dc
SHA1 3e3522e7f3af329f2235b0f0850d664d5377b3cd
SHA512 8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef
SSDEEP 1536:BG8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHM:BptQv1iyODswNLmqxY3AMV71Ev54EAxa
TLSH
T186937D107694D176D9D220BD718CD7715ABEA6B01FA880CBBB461BDA8C653C0BA3D30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup32.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
Size 1.5MB
SHA256 8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6
MD5 a5412a144f63d639b47fcc1ba68cb029
SHA1 81bd5f1c99b22c0266f3f59959dfb4ea023be47e
SHA512 2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405
SSDEEP 24576:GIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXig:GIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXV
TLSH
T1EB759D31B1D40332EA7103B177128AB7F63EEB9DE119D62579AE82592182B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxwsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Size 515KB
SHA256 8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da
MD5 ac3a5f7be8cd13a863b50ab5fe00b71c
SHA1 eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9
SHA512 c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba
SSDEEP 3072:diqLKVd9Aqq3Z/yKxAG2ur4IhUNJ4g3nO9hpRH0gQSpHt+akOC8BTDmsikzWX+us:DFAKJr4IWNJ4MOrpRBQS3kydI+xyS
TLSH
T1EEB4F05032F4D926F2F32B743ABDE26148BA7D90AA38C24D2502565D1BF3B40A56CF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxwsetup.inf

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
Size 477B
SHA256 d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00
MD5 ad8982eaa02c7ad4d7cdcbc248caa941
SHA1 4ccd8e038d73a5361d754c7598ed238fc040d16b
SHA512 5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28
TLSH
T191F05C5F6D438D0C30A535207AA346CBFF4C107051C5A08EB54DE05A87E87AD49AC0FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6bf632a71ee84b84edd415f469ae8b77453eca81b5b2de6ed5e412e8b92fffec
MD5 4444553fc9fe9f8b5afe4c579c754e60
SHA1 68c9306d376b5d9fa69c0fe776603261a9f2d87e
SHA512 f8f5c80b944ac5039b90214aca58b8b4c54d58b6764301af9e50a298ff077e08c41438a316eea46a368f9a9445c30c997094810efa455cd5985dfdc249c788d8
TLSH
T1B7D0122272020674C52022331042790E1441D21F804941016438C52E1B054541E06482
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ddac09194808016fee6f577b5368b1d8c613ec79ad82bfb4ede456657ca3e392
MD5 b870a58538758571c5400977c0de40b3
SHA1 c557fc72207bf687725aaf12857a390a13a89101
SHA512 21068865981a963e3ba6f55f1f51aead0605724ed068c22c2e147a55689ebdcb68715d0457b2052d2cf355f0388a529323d027f8010698c56ce9d99a719af4ad
TLSH
T12ED00470D1050570D750133110505D1711415554445503111030401505434041505041
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

308d2ed4-07e1-486c-a508-4952973e20fd.tmp

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\308d2ed4-07e1-486c-a508-4952973e20fd.tmp
Size 6KB
SHA256 109a7a15149715db33b2695a70c2c936554e398ff31c1fa9e787cc98d9316b7b
MD5 c368e79050935abbc727ab843c5fd359
SHA1 2284b40b68bd5a489d346077282a5e4373fbd9f9
SHA512 0112baa533438f1015049b5ebe6f6caf276a1736d5d610d24b7d39c360346bad7b212a6966cdbb04de7612bee65eceed3647a5fbfd05cc0057701351dd86fba5
SSDEEP 96:sti/dM++6yJb99kZo5h16Z00s7/x+6MhmuecJ9M6fhXie5K+gR28XM1C7K:st6Ob72on0sV+Fd9MKhSbbG6K
TLSH
T1C3D1B5475E2469BB4CC6E108BE35BA07E2F66072A1D11E49EBFC861C14DAACC6317C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\Cache\Cache_Data\f_00000d
Size 24KB
SHA256 9e986ae54a2e5eb4ea071539d76847ba87b969fe36b6cd71346734f633157b2b
MD5 8bf5b29ee08970a28d9df2838f54dff1
SHA1 1f17f150428e739c3a6a691c8332d0d92de01383
SHA512 4457c266d27e9bbd08bfecc98b519e0cf52b730d49a7f1eeab9aeb7a901e2829d7dd4dcb898c1a4f9abf50aaa41455594bf3a296f89db91a88214b09b3d79a55
SSDEEP 384:UHrIMaTCq/yCGZtmdGOV2DTnpqzsBlwdhDtdpmuQfVKRSoGWnjzegS517d/uM:GCpeZIjVgngzqlQR8HKRSo1zej53/V
TLSH
T19AB2E114CD483596AA70C61CE40281C78F892CF5917E5844F6B7798633DDC27B9091FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\Cache\Cache_Data\f_00000f
Size 24KB
SHA256 3f6baf4ab820e961f4d5cb96b80ba1e499e6e5ad1fd835899bcbbd7f071b5c99
MD5 47e11e4575efb93fc27d66db4a8fa3fe
SHA1 2541ec53a6d6dacba10dfcca6445065c6fda585b
SHA512 0d05a1a1409a36c628905c9f81f9a1b72b625deceb7a8acfeaa090ab712b3de393e104f20ba16086bce59b6c625c524bbd07ea2b35f4c401f53a09eca9e527e9
SSDEEP 384:nA3FcFaC3m9N4xik5S03T72ygHwmsIacDx/yryyRqheQkReStGBqlDVFyftDk4s:AVcFat925k03vBQwPcl/nyUjgeEjydkV
TLSH
T155B2E15CE421DD0186E0674FD118A7314FF2E253F6CAA7464CFDEE78B0E9A201AA0B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\Cache\Cache_Data\f_000011
Size 17KB
SHA256 b85eda32892083dc35555eacd3b7496192e5e27db346fbdc6ac2e0b090ac0184
MD5 c38b223da2e1018db652b03b92111114
SHA1 ba54c81fca566a6a82e024bad0552519da27a13d
SHA512 980399fecf7afc5d7cd4d8a00599273f5f2e3af0950658ca532c5d8ed760733a48803da9848ef85438b6fdf3c01ff96cf945bcda319d55b176cbe232f868645b
SSDEEP 384:ulu8KQF9NEXTcgegm079hNFin8RInalsonXh5nntX87DjubhOx:u4o9pzgm07ZFi8analZh9ntX83ylG
TLSH
T11882C197A8D7F7930BA8EC01BE104513135E7AE7D34EA41BBD677740E48548CDAB019E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 624B
SHA256 08b37be8e58207e2af0faa6b8e155ee21ebb1df76559d2108b233452433d1882
MD5 b70641ada50090211e12ced7da1064ee
SHA1 e4dc6336d433d359fc15dabd856942d9f2641158
SHA512 141c78daad9c3d6ba518529c3e794c4f1082ba8af4bba9a7623252096d184d76e04eb4bc7f43ae6218cd681e0e20d13a8cc28dd6bea91d56456eea73dc731d02
TLSH
T103F055A486959006EB7140FA09ED546C3F33E6053F130FC2438420B3AA163A8B3E4E32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a56e.TMP

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59a56e.TMP
Size 48B
SHA256 3fe6f6ac87fccbb4f76398da8256b5fcdab46b829864601ddc6b14844291c9d0
MD5 618f68fa8a36c25375d7a7f8d0303e08
SHA1 351ccba098055fb28611befc909346de6fe12142
SHA512 c63ea2896e5aeb16f386592e75bae0dd36b40626d8cc6666a9435a61d8bbf85d36d494607fae79e2e4c0734f41300c466611c762d41eabf0bf477e1ad024bab8
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 b4e913d5b31d8a1dd110e6985ae080b5d54e15f0b1bee7fa76edfcc84fa58ec0
MD5 b45a77ab58c03fd8054a71fa4c6cad5c
SHA1 a64e27e3f5d3a2e46f702f95b628467e7dc452f4
SHA512 2b5c1d239eb37556e6bf8c0a97a51533004e8a1cc91eb41d7775ffe0b0cde1e2532190353148d61909382518842c8051c0ae3530a2b27747969e867c4852fe64
TLSH
T11231A1E2C3E4C66D8A4166F467302927CD3D0519922C3D27CDDBEBE657D2472E22114F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a4af5.TMP

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\Network\Network Persistent State~RFe5a4af5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\Preferences
Size 6KB
SHA256 84455d2f98f49f4fa1d2e97fbc3f14c3ba1e04b4b1511ee0b55d2ff2e9fb7969
MD5 f4175b0754d5900422ecd5759212e811
SHA1 ecd5cb6bcaa45d7ab6baa7101ce1dad0cae15698
SHA512 78b222351f3afacf1ee1fcdf874ee9d9485a3159a477ef9805e74b40d8f819dd584d76cd4edee3e609cfa917fcb1453c307f0589bc2ab1023e0e7c477aaaeb74
SSDEEP 96:sti/dM++6JGJb99kZo5h16Z00s7/x+6MhmuecJWIzg9hXie5K+gO28XM1C7K:st6Ob92on0sV+FdXzqhSb4G6K
TLSH
T1A6D1B7475E6468BB8CC6E508BA35BA17D2F67072A1D11E58EBFC861C04DAADC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Local State
Size 2KB
SHA256 da3e86e313207eb7b554fb942851a087f9b376a8dc7a809f1a3020359fabe394
MD5 988f9dbf9205abb1c6ba611917be7922
SHA1 943ad96dcdafa542e821261282adeb693d7bb4fd
SHA512 2df171cffb5ec28299c382f5f3d69beaaa4c670386b63fe1a5237b862d0c40ee41b2c2bf17f15ec618c10b1283bc23fd76622fc67e7b81ba1e83bec6d6b1500b
TLSH
T1E85161B3A8249B77C9F2470878563F239E66A162EA522F119ADD4B0C01DBA5C1346CA2
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Local State
Size 3KB
SHA256 8d74bf29eb254688668667910c0f40edbf859aee00fc26d7142fa61234385adc
MD5 5daab3c6d5b997c3b059c83fd17ce457
SHA1 26249dae30f73df671c0ca4730a248b9d6a1b7f4
SHA512 aef10798a316c801e9a9281f89d068f4a4639ce8f27f94ba4f6e87af23fc515334520bd8fa19c261f1ee07b2d62caf394f7004629daecf1c4f0662ff5b56b510
TLSH
T1C26164776974DA778DF38A04B8863B16ABA66123E5853F55CAEC0F0C01D77881352C53
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Local State
Size 15KB
SHA256 d6a0a6850b3fc51d407fb2c107fb217a3f708b8621033f987211eaa1117e1b64
MD5 c82d15a328be97d248ef7f136aebc63d
SHA1 58aa65a2b9835df54d8030c8b7d78cd5f37b5eed
SHA512 68ef7ba92d4245f8615f8837b99ab5aa0ad196c186a9a63732fdd76fd3df98ff8ea6c07b1d053a379b649f0d2575d376c9e6f98861b5a1084d0aadb0eab94fc9
SSDEEP 384:M+aQikB+z/xvxjg/qhEqNBSqbqJwisdU19zY:r/UxvxjgC+mEwisiFY
TLSH
T1B7729E2B58783E3395F3EA057D4A075BDBB998B3D1826EB94AAD5F0C06C77D80342C42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59333b.TMP

Path C:\Users\Admin\AppData\Local\com.wutheringnest-launcher.shizuka\EBWebView\Local State~RFe59333b.TMP
Size 1KB
SHA256 5ab69913e6f63db47664c305a02e7bdbfffeba48ffd2e2d82709206e2d47bc62
MD5 4aa01feb0ae3d4e3747bca6295539062
SHA1 170947673e53ebd954b920f9ede05d895bdf8a8f
SHA512 fe3f7de3189bbbc8143f64f94376adfa737eca4eeb638f085f6c63b7edd30d4fc01699322cddbcb610b31b1c07a423650f3dc4022a953a8c1464798bb4a9ebdb
TLSH
T1DB2110F3E4748FB3DCE253593522BB576E222167D2014E0055DE8B0D02EA68C876BD72
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-303-0x000001B322000000-0x000001B322116000-memory.dmp

Download

memory/240-96-0x00007FFB43890000-0x00007FFB43891000-memory.dmp

Download

memory/1056-478-0x00000191BB5D0000-0x00000191BB5D1000-memory.dmp

Download

memory/1056-481-0x00000191BB5D0000-0x00000191BB5D1000-memory.dmp

Download

memory/1056-480-0x00000191BB5D0000-0x00000191BB5D1000-memory.dmp

Download

memory/1056-477-0x00000191BB5D0000-0x00000191BB5D1000-memory.dmp

Download

memory/1056-470-0x00000191BB5D0000-0x00000191BB5D1000-memory.dmp

Download

memory/1056-472-0x00000191BB5D0000-0x00000191BB5D1000-memory.dmp

Download

memory/1056-476-0x00000191BB5D0000-0x00000191BB5D1000-memory.dmp

Download

memory/1056-479-0x00000191BB5D0000-0x00000191BB5D1000-memory.dmp

Download

memory/1308-386-0x00007FFB442E0000-0x00007FFB442E1000-memory.dmp

Download

memory/1308-385-0x00007FFB42D30000-0x00007FFB42D31000-memory.dmp

Download

memory/4324-349-0x0000024775590000-0x00000247756A6000-memory.dmp

Download

memory/4324-343-0x0000024775590000-0x00000247756A6000-memory.dmp

Download

memory/4324-272-0x0000024775590000-0x00000247756A6000-memory.dmp

Download

memory/4324-19-0x00007FFB43890000-0x00007FFB43891000-memory.dmp

Download

memory/4324-518-0x0000024775590000-0x00000247756A6000-memory.dmp

Download